1.8.2: Enforce is available. Isolate is coming in a later release: its sealed workspace isn't ready yet.
MITRE ATLAS is the authoritative framework for adversarial threats to AI/ML systems. This page maps each technique to Crawdad's controls.
| ATLAS ID | Technique | Coverage | How | Notes |
|---|---|---|---|---|
| AML.T0051 | LLM Prompt Injection | Mitigated | Layer 1 pattern matching (128 regexes) + Layer 2 semantic heuristics (instruction density, boundary dissolution, authority impersonation) | 157 detection tests in our regression suite pass without a false positive on that suite’s benign cases. Novel patterns may require signature updates. |
| AML.T0054 | LLM Jailbreak | Mitigated | Layer 2 semantic detection: DAN/STAN/KEVIN mode, boundary dissolution, role hijacking, "do anything now" patterns | 43 known-bad jailbreak inputs in regression suite. |
| AML.T0056 | LLM Meta Prompt Extraction | Mitigated | Layer 2 sensitive data targeting: "show me your system prompt", "what are your instructions" patterns | Detects direct and indirect extraction attempts. |
| AML.T0057 | LLM Data Extraction | Mitigated | Layer 5 PII exfiltration detector: 15 PII categories, 10 credential types, internal URL detection, bulk data patterns | Runs on outbound responses. Redacts detected PII. |
| AML.T0043 | Craft Adversarial Data | Partial | Layer 3 indirect injection detector: catches instruction-like content in retrieved documents and tool outputs | Covers injection via external content. Does not cover adversarial examples targeting model perception. |
| AML.T0040 | ML Supply Chain Compromise | Partial | Skill attestation (SHA-256 hashing), SBOM generation, dependency auditing | Covers skill/plugin supply chain. Does not cover model weight tampering. |
| AML.T0049 | Exploit Public-Facing Application | Partial | Proxy scans all inbound traffic. Layer 1 detects malicious payloads (SQL injection, shell injection, path traversal). | Covers injection through agent interfaces. Does not cover web app vulnerabilities. |
| AML.T0051.001 | Direct Prompt Injection | Mitigated | Layers 1+2 scan user messages before they reach the model | Primary detection target. Highest confidence coverage. |
| AML.T0051.002 | Indirect Prompt Injection | Partial | Layer 3 detects injections in retrieved documents. Layer 2 detects injection markers in any content. | Effective against known patterns. Novel indirect injection vectors may evade detection. |
| AML.T0048 | Backdoor ML Model | Awareness | Threat intelligence feed tracks known backdoor research. No runtime detection. | Model integrity is the provider's responsibility. Crawdad operates at the application layer. |
| AML.T0020 | Poison Training Data | Awareness | Threat intelligence tracks poisoning research. No training-time controls. | Crawdad detects at inference time, not training time. |
| AML.T0047 | ML Model Inference API Access | Awareness | Audit log records all API access patterns. Anomalous access visible in dashboard. | Detection only, not prevention. API access controls are the provider's responsibility. |
| AML.T0016 | Obtain Capabilities | Not covered | – | Reconnaissance and capability enumeration are outside Crawdad's scope. |
| AML.T0044 | Full ML Model Access | Not covered | – | Model access is controlled by the API provider, not the application layer. |
Coverage levels are defined as:
Mitigated, active detection with automated tests; blocking depends on the protection level (the credential and data-exfiltration floors block inline at every protection level on chat traffic that goes through Crawdad (credentials also in agent tool calls and on supported AI sites), broader blocking comes with Enforce).
Partial, Detection covers known attack patterns but not all variants.
Awareness, Threat tracked in intelligence feed but no active runtime mitigation.
Not covered, Outside Crawdad's architecture scope.